CN103457799B - Microblog zombie user detection method based on graph of a relation - Google Patents

Abstract

The microblog zombie user detection method based on relational graph analysis includes a data collection module and a relational graph analysis module; the data collection module is used to collect data of a known zombie user and select sample users from the data. The relationship graph analysis module is used to judge whether the sample user is a zombie user: first, establish a relationship graph between known zombie users and sample users; initialize the user’s malicious score; calculate the user’s relevance value and calculate and update the sample according to the relationship graph and propagation rules Malicious score of the user; judging whether the malicious score of the sample user is spread and converged; judging whether the malicious score of the sample user whose spread is converged is greater than a threshold, and if it is greater than the threshold, the sample user is a zombie user. The invention utilizes the social relationship and the semantic relationship of the zombie user to find and identify other zombie users, thereby improving the discrimination efficiency of the zombie user. The invention is applied to the social network, provides more safe and effective detection service for it, and improves the security of the social network.

Description

Microblog Zombie User Detection Method Based on Relationship Graph

technical field

The invention relates to a method for detecting a microblog zombie user, in particular to a method for detecting a microblog zombie user based on a relationship graph.

Background technique

In today's technological era, with the popularity of smart communication terminals, the mobile Internet has increasingly entered people's daily lives. At present, social networking is a very popular application in the mobile Internet, such as "Facebook" and "Twitter" in foreign countries. In China, online social networking has gradually become a major platform. The more familiar and commonly used one is Weibo. People Collect information on the Internet through Weibo and make friends with like-minded people. Microblog, short for MicroBlog, is a blog-like system that can publish messages in real time, and is a platform for information sharing, dissemination, and acquisition based on user relationships. Weibo has been dubbed China's "Twitter" because of its resemblance to Twitter. Weibo can not only meet the needs of users to recommend each other's interested online consultation, but also pay attention to celebrities or friends they admire, check other people's latest developments or express their own latest remarks, so as to achieve the purpose of sharing happiness with others, so Weibo has gained a lot of attention. More and more people love it.

However, Weibo and "Twitter" are different from the perspective of users' usage habits and different cultures. According to the research of Hewlett-Packard Labs, people prefer to forward information on Weibo rather than publish original Weibo. As long as the sharing is valuable, people will be very enthusiastic to help forward it on Weibo. Also, the two differ in terms of user experience. In "Twitter", people can only share text information, but in Weibo, people can also share pictures, video and audio. In addition, Weibo also allows users to reply to the status and forward it at the same time, which is not feasible in "Twitter".

With the widespread development of Weibo, many false users, namely zombie users, have appeared. There are many reasons for the emergence of these zombie users. On the one hand, in order to satisfy the vanity of Weibo users and increase the attention of personal Weibo, some people choose to spend money to buy some fake users to increase the number of their own user threads. This behavior greatly reduces the personal integrity of users; On the one hand, some people take advantage of the detection loopholes of Weibo to sell "zombie users" wantonly. Those who control the "zombie users" behind the scenes obtain a lot of profits through transactions, resulting in the emergence of the industrial chain of zombie users, which brings more benefits to Weibo. No small negative impact. This is also an obvious difference between Weibo and "Twitter".

Now, many people study western social networking sites, however, research on Chinese social networks is blank. Due to the huge difference between Weibo and "Twitter", those skilled in the art are devoting themselves to developing a method for detecting Weibo zombie users.

Contents of the invention

In view of the above-mentioned defects in the prior art, the technical problem to be solved by the present invention is to provide a method for detecting microblog zombie users based on visual relationship graph analysis.

To achieve the above object, the present invention provides a method for detecting microblog zombie users based on a visual relationship network, which is characterized in that it includes a data collection module and a relationship graph analysis module;

The data collection module is used to collect the data of a known zombie user according to a known zombie user, and select a sample user;

The relationship graph analysis module is used to judge whether the sample user is a zombie user, specifically including the following steps:

Step 201, visualize the relationship attributes between the known zombie users and the sample users, and make a relationship diagram: the known zombie users and the sample users are both nodes of the relationship diagram;

Step 202, initializing the malicious scores of the known zombie users and the sample users;

Step 203, analyzing the commonality of the relationship graph, calculating the correlation value of each node in the relationship graph, and calculating and updating the malicious score of the sample user according to the propagation rules and the relationship graph;

Step 204, judging whether the malicious score of the sample user is propagated and converged, if the propagation is converged, jump to step 205; if not propagated and converged, then jump to step 203;

Step 205, judging whether the malicious score of the sample user is greater than a threshold, if greater than the threshold, jump to step 206; if less than the threshold, the sample user is judged as a normal user;

Step 206: The sample user is determined to be a zombie user;

Step 207: the processing is completed.

Further, the data collection module is the data of the known zombie users collected through Weibo API.

Further, the data of the known zombie users include the names and numbers of the user's fans and followers.

Further, the selection of the sample users by the data collection module is random.

Further, the number of fans and followers of the sample user selected by the data collection module is less than 1000.

Further, the adjacent nodes of the relationship graph in step 201 have a relationship of following and being followed.

Further, in the step 202, the malicious score of the known zombie user is initialized to 1, and the malicious score of the sample user is initialized to 0.

Further, in the step 203, the relevance value of the node is the reciprocal of the number of fans of the user corresponding to the node.

Further, the propagation rules in step 203 include:

a) When calculating the malicious score of a user's fans, the fan's malicious score is the user's malicious score multiplied by the user's relevance value;

b) When a user follows multiple users, a user's malicious score is the sum of the malicious scores of the multiple users it follows.

Further, the convergence of the propagation in step 204 means that the malicious score of the sample user becomes stable and no longer changes.

Because Weibo lacks a detection mechanism for zombie users, through a comprehensive analysis of the network of zombie users, the detection method trained has higher accuracy and regression, and better overall performance. Bot user identification for Chinese social networks. Since most zombie users are automatically generated by the system, their IDs are largely similar. In addition, in order to avoid being detected, zombie users often follow each other so that they look no different from normal users. Therefore, in their social There will be many users with similar IDs gathered together in the network graph, so if a zombie user can be found in advance, it is very likely to find related zombie users, which greatly improves the efficiency of the reasoning algorithm.

The idea, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings, so as to fully understand the purpose, features and effects of the present invention.

Description of drawings

Fig. 1 is the processing procedure of the data collection module of the present invention;

Fig. 2 is a processing flowchart of the relationship graph analysis module of the present invention.

detailed description

Below in conjunction with accompanying drawing, the embodiment of the present invention is described in detail: present embodiment implements under the premise of the technical scheme of the present invention, has provided detailed implementation and specific operation process, but protection scope of the present invention is not limited to the following the embodiment.

A method for detecting microblog zombie users based on a relationship diagram of the present invention is divided into two modules: a data collection module and a relationship diagram analysis module.

The processing flow of the data collection module is shown in Figure 1. First, collect the data 102 of known zombie users from the accounts of known zombie users through Weibo API (Application Programming Interface, application programming interface) 101, that is, the user names and numbers of fans and followers of the zombie user; Then, collect the data of user fans and followers of known zombie users; finally, select sample users from the user fans and followers of known zombie users, and store the data of sample users and known zombie users in the relational database, The sample users are randomly selected. In a preferred embodiment of the present invention, in order to ensure the randomness of selection, among the fans and followers of known zombie users, users whose fans and followers do not exceed 1000 are selected as sample users.

The processing of the data collection module is to obtain user information through manual login to Weibo: each Weibo user has its own user name, and according to the user name, each user has a link to a personal page: http://weibo .com/userid, log in to this page, the user's data (user fans and followers) can be checked at a glance.

The processing flow of the relationship graph analysis module is shown in Figure 2, which specifically includes the following steps:

Step 201, visualize the relationship attributes between known zombie users and sample users, and make a relationship diagram:

Each user (including known zombie users and sample users) is regarded as a node. For any two users, if there is a relationship between them and being followed, there is a link between the two nodes Directed line segments are connected, and the direction is from fans to followed users.

Step 202, initialize the malicious score of each node user (including known zombie users and sample users): set the malicious score of known zombie users to 1, and set the malicious score of each sample user to 0;

Step 203, analyze the commonality of the relationship graph and obtain the social relationship of the zombie users, calculate and update the malicious score of the sample users:

1) Calculate the user's correlation value: count the number of fans of each user, and take the inverse of this number to get the correlation value between the user and its fans;

2) The relevance value is used as the edge weight of the relationship graph between the user and its adjacent users;

3) Calculate the malicious score of the sample user according to the correlation value and the malicious score of known zombie users according to the propagation rules. The score is multiplied by the user's relevance value; b) When a user follows multiple users, the user's score will be the sum of the malicious scores of all users followed by the user;

4) Iteratively calculate according to the relationship graph, and update the malicious score of each sample user.

Step 204, judging whether the malicious score of the sample user reaches a stable value and does not change, that is, the propagation is converged: if the propagation is converged, go to step 205; if not, go to step 203.

Step 205, judge the malicious score value of each sample user at this time: if the malicious score is greater than the threshold (the threshold can be determined by a heuristic experiment), then jump to step 206; if the malicious score is smaller than the threshold, the user is judged for normal users.

Step 206: The sample user is determined to be a zombie user.

Step 207: The determination of the zombie user ends.

The preferred specific embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make many modifications and changes according to the concept of the present invention without creative efforts. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art shall be within the scope of protection defined by the claims.

Claims (10)

1. A microblog zombie user detection method based on a visual relational network, characterized in that it comprises a data collection module and a relational graph analysis module; The data collection module is used to collect the data of a known zombie user according to a known zombie user, and select a sample user; The relationship graph analysis module is used to judge whether the sample user is a zombie user, specifically including the following steps: Step (201), visualize the relationship attributes between the known zombie users and the sample users, and make a relationship graph: the known zombie users and the sample users are both nodes of the relationship graph; Step (202), initializing the malicious scores of the known zombie users and the sample users; Step (203), analyzing the commonality of the relationship graph, calculating the correlation value of each node in the relationship graph, and calculating and updating the malicious score of the sample user according to the propagation rules and the relationship graph; Step (204), judging whether the malicious score of the sample user is propagated and converged, if propagated and converged, jump to step (205); if not propagated and converged, then jump to step (203); Step (205), judging whether the malicious score of the sample user is greater than a threshold, if greater than the threshold, jump to step (206); if less than the threshold, then the sample user is determined to be a normal user ; Step (206), the sample user is determined to be a zombie user; Step (207), the processing is completed. 2. The microblog zombie user detection method according to claim 1, wherein the data collection module collects the data of the known zombie users through a microblog API. 3. The method for detecting microblog zombie users as claimed in claim 1, wherein the data of said known zombie users includes names and numbers of fans and followers of the user. 4. The microblog zombie user detection method according to claim 1, wherein the selection of the sample users by the data collection module is random. 5. The microblog zombie user detection method as claimed in claim 1, wherein the number of user fans and followers of the sample user selected by the data collection module is less than 1000. 6. The method for detecting microblog zombie users according to claim 1, wherein there is a relationship of following and being followed between adjacent nodes of the relationship graph in the step (201). 7. The microblog zombie user detection method as claimed in claim 1, wherein, in the step (202), the malicious score of the known zombie user is initialized to 1, and the malicious score of the sample user is initialized to 0 . 8. The microblog zombie user detection method according to claim 1, wherein, in the step (203), the relevance value of the node is the reciprocal of the number of fans of the user corresponding to the node. 9. microblog zombie user detection method as claimed in claim 1, wherein, described propagation rule in described step (203) comprises: a) When calculating the malicious score of a user's fans, the fan's malicious score is the user's malicious score multiplied by the user's relevance value; b) When a user follows multiple users, the malicious score of a user is the sum of the malicious scores of the multiple users it follows. 10. The microblog zombie user detection method according to claim 1, wherein the propagation convergence described in the step (204) means that the malicious score of the sample user reaches a stability and no longer changes.